CLIPStudio[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

CLIPStudio.exe
Size

22.6MB
MD5

983082f6c5f49b00993adf501e1f7516
SHA1

30d9eb6771571770d3d5545b8952284ef2a23c27
SHA256

6a1e6b549c82a644b83be70dfdc9df8caa81e7f5cd84ca51c2fe3859a347f1f6
SHA512

4c0be4a37b86930496dd23906c5b3de228d04efa7bffb4ded5b913485d5a5ce69f2282014f2f10cd4734183649ad158be03b5376e5b526042def32eff0120a94
SSDEEP

393216:0tAieMW84zpwrU4OtTl21AmTewPuNjEy0gUD2eqVS3WpagLmxaL1z9oW1HVy2FgZ:lHMuVeUX6ynDA3NgLmxY1z9oWxGI2

Score

N/A

Malware Config

Signatures

Files

CLIPStudio.exe
.exe windows x86

22d3e47cf7227c26d8735c3ac03af75c

Code Sign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28-07-2020 00:00

Not After

18-03-2029 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28-07-2020 00:00

Not After

28-07-2030 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

11:45:b9:56:f1:b8:9c:26:d2:97:f7:7f
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

20-08-2021 07:09

Not After

11-10-2022 09:03

Subject

SERIALNUMBER=0111-01-051944,CN=CELSYS\, Inc.,OU=Development,O=CELSYS\, Inc.,L=Shinjuku-ku,ST=Tokyo,C=JP,1.3.6.1.4.1.311.60.2.1.3=#13024a50,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06-04-2022 07:44

Not After

08-05-2033 07:44

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20-06-2018 00:00

Not After

10-12-2034 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20-02-2019 00:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:f1:2f:02:33:32:9e:5f:21:f3:d5:c0:a8:50:0c:2a:a9:e5:19:e9:f2:98:69:26:e5:21:c4:25:3a:22:e1:65
Signer

Actual PE Digest

41:f1:2f:02:33:32:9e:5f:21:f3:d5:c0:a8:50:0c:2a:a9:e5:19:e9:f2:98:69:26:e5:21:c4:25:3a:22:e1:65

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=0111-01-051944,CN=CELSYS\, Inc.,OU=Development,O=CELSYS\, Inc.,L=Shinjuku-ku,ST=Tokyo,C=JP,1.3.6.1.4.1.311.60.2.1.3=#13024a50,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

19-05-2022 23:32
Valid: true

Chain 1

SERIALNUMBER=0111-01-051944,CN=CELSYS\, Inc.,OU=Development,O=CELSYS\, Inc.,L=Shinjuku-ku,ST=Tokyo,C=JP,1.3.6.1.4.1.311.60.2.1.3=#13024a50,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TryEnterCriticalSection
InitializeCriticalSection
DeleteCriticalSection
OpenEventA
ResetEvent
GetCurrentProcessId
WaitForSingleObjectEx
EnterCriticalSection
LeaveCriticalSection
GetSystemInfo
GetLongPathNameW
DecodePointer
RaiseException
CreateMutexW
Sleep
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadLibraryExW
LoadResource
SizeofResource
FindResourceW
lstrcmpiW
GlobalAddAtomW
GetCurrentThreadId
OutputDebugStringA
OutputDebugStringW
MapViewOfFile
CreateFileMappingW
LoadLibraryA
GlobalDeleteAtom
LockFileEx
GlobalGetAtomNameW
UnlockFile
HeapDestroy
GetComputerNameW
GetUserDefaultUILanguage
SwitchToThread
UnmapViewOfFile
CreateFileMappingA
MapViewOfFileEx
GetModuleHandleA
GlobalFree
HeapCompact
WaitForSingleObject
CreateEventW
HeapReAlloc
SetThreadPriority
DeleteFileA
GlobalAlloc
GlobalSize
GlobalUnlock
FlushViewOfFile
GetFileAttributesExW
GetFileAttributesA
GlobalLock
LoadLibraryW
SetLastError
GetFileSizeEx
SetEndOfFile
SetFilePointerEx
GetSystemTimeAsFileTime
GetProcessTimes
GetTickCount
GetDiskFreeSpaceA
GetTempPathA
HeapSize
FindFirstFileA
HeapValidate
UnlockFileEx
LockFile
GetDiskFreeSpaceW
HeapCreate
AreFileApisANSI
FindNextFileA
FindClose
CreateMutexA
ReleaseMutex
CreateSemaphoreA
ReleaseSemaphore
RemoveDirectoryA
CreateProcessW
OpenMutexW
GetProcessHeap
HeapFree
HeapAlloc
QueryPerformanceCounter
ConvertFiberToThread
QueryPerformanceFrequency
GetEnvironmentVariableW
GetConsoleMode
SetConsoleMode
GetExitCodeProcess
CreateDirectoryW
InitializeCriticalSectionAndSpinCount
DeleteFileW
UnhandledExceptionFilter
FileTimeToLocalFileTime
SetUnhandledExceptionFilter
ReadConsoleA
IsDBCSLeadByteEx
IsValidCodePage
MultiByteToWideChar
GetVersionExA
GetCurrentProcess
GetLastError
DuplicateHandle
WriteFile
GetDiskFreeSpaceExW
SetFilePointer
ReadFile
GetDriveTypeW
GetFullPathNameA
GetFullPathNameW
GetFileAttributesW
GetFileTime
LocalFileTimeToFileTime
RemoveDirectoryW
SetFileAttributesW
SetFileTime
GetTempPathW
GetWindowsDirectoryW
MoveFileExW
FileTimeToSystemTime
SystemTimeToFileTime
GlobalMemoryStatusEx
VirtualAlloc
VirtualFree
K32GetProcessMemoryInfo
FindFirstFileW
FindNextFileW
GetFileSize
GetSystemTime
GetLocalTime
CreateFileW
CreateFileA
FlushFileBuffers
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
EncodePointer
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
LoadLibraryExA
GetModuleHandleExW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetFileType
GetVersionExW
DeleteFiber
GetCurrentDirectoryW
GetCurrentDirectoryA
GetStdHandle
CloseHandle
SetEvent
CreateEventA
LocalFree
WideCharToMultiByte
FormatMessageW
InitializeCriticalSectionEx
FormatMessageA
GetLogicalDrives
ReadConsoleW

user32

KillTimer
SetTimer
ReleaseCapture
SetCapture
GetCapture
GetFocus
GetActiveWindow
SetFocus
ChangeClipboardChain
SetClipboardViewer
CloseClipboard
OpenClipboard
GetDlgCtrlID
GetDlgItem
IsZoomed
SetWindowPlacement
GetWindowPlacement
SetWindowPos
MoveWindow
SetLayeredWindowAttributes
UpdateLayeredWindow
ShowWindow
DestroyWindow
IsChild
CreateWindowExW
RegisterClassExW
DefWindowProcW
SendMessageTimeoutW
GetMessageExtraInfo
TrackMouseEvent
FindWindowW
SetForegroundWindow
GetKeyState
CharNextW
IsIconic
IsWindowVisible
UnregisterClassW
PostQuitMessage
PostMessageW
SendNotifyMessageW
SendMessageW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
SetCursor
GetCursorPos
GetForegroundWindow
IsWindowEnabled
WindowFromPoint
GetWindowLongW
SetWindowLongW
GetClassLongW
SetClassLongW
GetParent
SetParent
EnumChildWindows
FindWindowExW
GetWindowThreadProcessId
GetWindow
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
LoadCursorW
MonitorFromPoint
MonitorFromRect
MonitorFromWindow
GetMonitorInfoW
GetWindowInfo
GetAncestor
GetSystemMetrics
EnumDisplayMonitors
EnumDisplayDevicesW
SetClipboardData
GetClipboardData
EnumClipboardFormats
EmptyClipboard
MessageBoxW
DrawTextW
GetDC
ReleaseDC
FillRect
SystemParametersInfoW
RegisterClipboardFormatW
MapVirtualKeyW
PostThreadMessageW
GetAsyncKeyState
DestroyCursor
CreateIconIndirect
MessageBeep
CallWindowProcW
GetClassInfoExW
IsWindow
GetProcessWindowStation
GetUserObjectInformationW
BeginPaint
EnableWindow
UpdateWindow
ScreenToClient
LoadIconW
EndPaint
SetWindowRgn
InvalidateRect
SetActiveWindow
SetPropW
GetPropW
RemovePropW
RegisterClassW
SetWindowTextW
GetClientRect
GetWindowRect
ClientToScreen
AdjustWindowRectEx

advapi32

CryptCreateHash
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW
DeregisterEventSource
SetFileSecurityW
GetSecurityDescriptorDacl
GetFileSecurityW
GetAclInformation
ConvertSidToStringSidW
LookupAccountNameW
ReadEventLogA
CloseEventLog
OpenEventLogA
RegQueryValueExW
GetUserNameA
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CryptDecrypt

msvcp140

_Mtx_lock
_Mtx_unlock
?_Throw_C_error@std@@YAXH@Z
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?uncaught_exception@std@@YA_NXZ
??Bid@locale@std@@QAEIXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Fiopen@std@@YAPAU_iobuf@@PBGHH@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
_Mtx_init_in_situ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAM@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@O@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?id@?$ctype@D@std@@2V0locale@2@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
?exceptions@ios_base@std@@QAEXH@Z
??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
_Xtime_get_ticks
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@AAD@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@PAV32@@Z
_Mtx_destroy_in_situ
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z
?narrow@?$ctype@D@std@@QBEDDD@Z
?widen@?$ctype@D@std@@QBEDD@Z
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z
?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z
??_D?$basic_istream@DU?$char_traits@D@std@@@std@@QAEXXZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?widen@?$ctype@D@std@@QBEPBDPBD0PAD@Z
?toupper@?$ctype@D@std@@QBEDD@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
?_Xlength_error@std@@YAXPBD@Z

shlwapi

PathFindFileNameW

imm32

ImmNotifyIME
ImmGetContext
ImmReleaseContext
ImmGetConversionStatus
ImmSetCandidateWindow
ImmSetCompositionWindow
ImmSetCompositionFontW
ImmGetCompositionStringW
ImmGetVirtualKey
ImmSetOpenStatus
ImmGetOpenStatus
ImmSetConversionStatus

concrt140

??1_StructuredTaskCollection@details@Concurrency@@QAE@XZ
?_Schedule@_StructuredTaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@@Z
?_RunAndWait@_StructuredTaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z
??0_Cancellation_beacon@details@Concurrency@@QAE@XZ
?_CheckTaskCollection@_UnrealizedChore@details@Concurrency@@IAEXXZ
?_Confirm_cancel@_Cancellation_beacon@details@Concurrency@@QAE_NXZ
?_Trace_ppl_function@Concurrency@@YAXABU_GUID@@EW4ConcRT_EventType@1@@Z
?_SpinOnce@?$_SpinWait@$00@details@Concurrency@@QAE_NXZ
?PPLParallelForEventGuid@Concurrency@@3U_GUID@@B
?_CurrentContext@_Context@details@Concurrency@@SA?AV123@XZ
?_UnderlyingYield@details@Concurrency@@YAXXZ
?_GetNumberOfVirtualProcessors@_CurrentScheduler@details@Concurrency@@SAIXZ
?Free@Concurrency@@YAXPAX@Z
?_IsSynchronouslyBlocked@_Context@details@Concurrency@@QBE_NXZ
??1_Cancellation_beacon@details@Concurrency@@QAE@XZ
?_Yield@_Context@details@Concurrency@@SAXXZ

vcruntime140

__CxxLongjmpUnwind
_setjmp3
wcsstr
__std_type_info_name
memchr
__RTtypeid
strrchr
__current_exception
__current_exception_context
_except_handler4_common
strstr
wcschr
__CxxFrameHandler3
strchr
__RTDynamicCast
memset
memmove
memcmp
longjmp
__std_exception_destroy
__std_exception_copy
memcpy
_purecall
__std_terminate
_CxxThrowException
__std_type_info_compare

api-ms-win-crt-heap-l1-1-0

_aligned_free
free
malloc
_recalloc
_msize
_callnewh
_set_new_mode
realloc
_aligned_malloc
calloc

api-ms-win-crt-runtime-l1-1-0

signal
raise
_invalid_parameter_noinfo
_crt_atexit
_cexit
terminate
_seh_filter_exe
_set_app_type
_configure_wide_argv
_initialize_wide_environment
_initialize_onexit_table
__p___argc
__p___wargv
_endthreadex
exit
_invalid_parameter_noinfo_noreturn
_register_onexit_function
strerror
_beginthreadex
_controlfp_s
abort
_get_wide_winmain_command_line
_initterm
_initterm_e
_exit
_errno
_c_exit
_register_thread_local_exe_atexit_callback
strerror_s

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf
_set_fmode
__stdio_common_vsprintf
__stdio_common_vswprintf_s
fclose
fflush
fopen
__stdio_common_vsprintf_s
fread
fputs
__stdio_common_vfprintf
fsetpos
fseek
__stdio_common_vsscanf
_fseeki64
_wfopen
ftell
fwrite
setvbuf
_get_stream_buffer_pointers
__acrt_iob_func
fputc
fgetpos
fgetc
ungetc
__p__commode
feof
ferror
fgets
_fileno
_setmode

api-ms-win-crt-string-l1-1-0

strcpy
strcat
wcscpy
strcmp
wcslen
wcscmp
strlen
isprint
isdigit
strtok
strspn
_strnicmp
strncpy
isalnum
_stricmp
strncmp
isspace
strcspn
wcsncpy_s
_wcsupr
toupper
_wcsicmp
_wcsnicmp
_wcslwr

api-ms-win-crt-convert-l1-1-0

strtoul
atoi
strtod
strtol
atof

api-ms-win-crt-time-l1-1-0

_gmtime64
_localtime64_s
_time64
_gmtime64_s
_localtime64

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

localeconv
_configthreadlocale

api-ms-win-crt-math-l1-1-0

modf
_finite
_dclass
_dsign
_libm_sse2_sin_precise
_libm_sse2_cos_precise
floor
_libm_sse2_log10_precise
ceil
_libm_sse2_sqrt_precise
_libm_sse2_atan_precise
_libm_sse2_log_precise
_libm_sse2_exp_precise
_libm_sse2_pow_precise
_isnan
_libm_sse2_asin_precise
_libm_sse2_acos_precise
__setusermatherr
_CIatan2
hypot
_libm_sse2_tan_precise
_CIfmod

api-ms-win-crt-utility-l1-1-0

_lrotr
_lrotl
bsearch
qsort
rand

api-ms-win-crt-filesystem-l1-1-0

_unlock_file
_access
_stat64i32
_lock_file

glu32

gluBuild2DMipmaps
gluOrtho2D
gluScaleImage

opengl32

glIsEnabled
glIsTexture
glLightModelfv
glLightModeli
glLightf
glLightfv
glLineStipple
glLineWidth
glLoadIdentity
glLoadMatrixf
glLogicOp
glMaterialf
glMaterialfv
glMatrixMode
glMultMatrixf
glNewList
glNormal3fv
glNormalPointer
glPixelStorei
glPointSize
glPolygonMode
glPolygonOffset
glPolygonStipple
glPopAttrib
glPopClientAttrib
glPopMatrix
glPushAttrib
glPushClientAttrib
glPushMatrix
glReadPixels
glGetTexLevelParameteriv
glRotated
glScaled
glScalef
glScissor
glShadeModel
glStencilFunc
glStencilOp
glTexCoord2f
glTexCoord2fv
glTexCoordPointer
glTexImage2D
glTexParameterfv
glTexParameteri
glTexSubImage2D
glTranslated
glTranslatef
glVertex2f
glVertex2i
glVertex3d
glVertex3f
glVertex3fv
glVertex4fv
glVertexPointer
glViewport
glClear
glCallList
glBlendFunc
glBindTexture
glBegin
glAlphaFunc
glGetString
glGetIntegerv
glGetFloatv
glGetError
glGetBooleanv
wglGetCurrentDC
wglGetProcAddress
wglCreateContext
wglDeleteContext
wglGetCurrentContext
wglMakeCurrent
wglShareLists
glGenTextures
glGenLists
glFlush
glFinish
glEndList
glEnd
glClearColor
glEnable
glDrawElements
glDrawBuffer
glDrawArrays
glDisableClientState
glDisable
glDepthMask
glDepthFunc
glDeleteTextures
glDeleteLists
glCullFace
glColorPointer
glColorMask
glColor4fv
glColor4f
glColor3fv
glColor3f
glColor3d
glClipPlane
glClearStencil
glClearDepth
glEnableClientState

jpeg62

ord31
ord43
ord44
ord81
ord84
ord86
ord98
ord49
ord96
ord75
ord87
ord77
ord50
ord83
ord78
ord30
ord89

libpng16

png_set_text
png_set_iCCP
png_get_iCCP
png_get_sRGB
png_set_pHYs
png_get_pHYs
png_sig_cmp
png_set_longjmp_fn
png_create_read_struct_2
png_create_write_struct_2
png_create_info_struct
png_write_info
png_read_info
png_set_expand_gray_1_2_4_to_8
png_set_palette_to_rgb
png_set_tRNS_to_alpha
png_set_swap_alpha
png_set_swap
png_set_packing
png_set_interlace_handling
png_set_strip_16
png_read_update_info
png_read_image
png_write_row
png_write_end
png_read_end
png_destroy_read_struct
png_destroy_write_struct
png_set_filter
png_set_compression_level
png_set_write_fn
png_set_read_fn
png_get_io_ptr
png_malloc
png_free
png_set_benign_errors
png_get_valid
png_get_rowbytes
png_get_IHDR
png_set_IHDR

tiff

TIFFReadEncodedStrip
TIFFNumberOfStrips
_TIFFmalloc
TIFFSetWarningHandlerExt
TIFFSetWarningHandler
TIFFSetErrorHandlerExt
TIFFSetErrorHandler
TIFFOpenW
TIFFReadScanline
TIFFSetField
TIFFStripSize
TIFFScanlineSize
TIFFGetFieldDefaulted
TIFFGetField
TIFFClose
_TIFFfree
_TIFFmemcpy
TIFFWriteEncodedStrip

comctl32

ord17

mscms

CloseColorProfile
GetColorProfileHeader
CreateMultiProfileTransform
DeleteColorTransform
TranslateColors
GetColorDirectoryW
GetStandardColorSpaceProfileW
WcsGetDefaultColorProfileSize
WcsGetDefaultColorProfile
OpenColorProfileW
WcsGetUsePerUserProfiles

rpcrt4

UuidFromStringW

winmm

timeBeginPeriod
timeEndPeriod
timeGetTime

boost_date_time

??0greg_month@gregorian@boost@@QAE@G@Z

zlib

deflateEnd
deflateReset
deflateInit2_
inflate
inflateEnd
deflate
inflateInit2_
inflateReset
adler32
inflateInit_
crc32

gdiplus

GdipFillPath
GdipDrawPath
GdipResetWorldTransform
GdipDeleteMatrix
GdipCreateMatrix2
GdipGetPathWorldBounds
GdipTransformPath
GdipAddPathPath
GdipAddPathBeziers
GdipAddPathLine2
GdipClosePathFigure
GdipSetPathFillMode
GdipDeletePath
GdipCreatePath
GdipCreateFont
GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipDrawImageI
GdipFillRectangleI
GdipCreateFromHDC
GdipGetImageHeight
GdipGetImageWidth
GdipFillRectangle
GdipSetSmoothingMode
GdipDeletePen
GdipCreatePen1
GdiplusShutdown
GdiplusStartup
GdipSetStringFormatHotkeyPrefix
GdipSetStringFormatTrimming
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipGetStringFormatFlags
GdipSetStringFormatFlags
GdipDeleteStringFormat
GdipCreateStringFormat
GdipMeasureString
GdipDrawString
GdipDeleteFont
GdipCreateFontFromLogfontW
GdipSetClipRect
GdipTranslateWorldTransform
GdipDeleteGraphics
GdipCreateBitmapFromScan0
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipFree
GdipAlloc

boost_thread

?yield@thread@boost@@SAXXZ
?get_id@thread@boost@@QBE?AVid@12@XZ
??4thread@boost@@QAEAAV01@$$QAV01@@Z
??0thread@boost@@QAE@XZ
?notify_all_at_thread_exit@thread_data_base@detail@boost@@UAEXPAVcondition_variable@3@PAVmutex@3@@Z
?future_category@boost@@YAABVerror_category@system@1@XZ
?do_try_join_until@thread@boost@@AAE_NABUmono_platform_timepoint@detail@2@@Z
?interruptible_wait@this_thread@boost@@YA_NPAXABUmono_platform_timepoint@detail@2@@Z
?get_current_thread_data@detail@boost@@YAPAUthread_data_base@12@XZ
?make_ready_at_thread_exit@thread_data_base@detail@boost@@QAEXV?$shared_ptr@Ushared_state_base@detail@boost@@@3@@Z
??1thread_data_base@detail@boost@@UAE@XZ
??0thread_data_base@detail@boost@@QAE@XZ
?duplicate@handle_manager@win32@detail@boost@@QBEPAXXZ
?join@thread@boost@@QAEXXZ
??1thread@boost@@QAE@XZ
?start_thread@thread@boost@@AAEXXZ
??1handle_manager@win32@detail@boost@@QAE@XZ

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

boost_regex

?construct_init@?$perl_matcher@PBDV?$allocator@U?$sub_match@PBD@boost@@@std@@U?$regex_traits@DV?$w32_regex_traits@D@boost@@@boost@@@re_detail_107200@boost@@AAEXABV?$basic_regex@DU?$regex_traits@DV?$w32_regex_traits@D@boost@@@boost@@@3@W4_match_flags@regex_constants@3@@Z
?do_assign@?$basic_regex@DU?$regex_traits@DV?$w32_regex_traits@D@boost@@@boost@@@boost@@AAEAAV12@PBD0I@Z
?match@?$perl_matcher@PBDV?$allocator@U?$sub_match@PBD@boost@@@std@@U?$regex_traits@DV?$w32_regex_traits@D@boost@@@boost@@@re_detail_107200@boost@@QAE_NXZ

crypt32

CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertCloseStore
CertOpenStore
CertGetCertificateContextProperty
CertFreeCertificateContext

ws2_32

closesocket
recv
WSASetLastError
WSAGetLastError
send
WSACleanup

wininet

HttpEndRequestW
HttpQueryInfoW
HttpSendRequestExW
HttpSendRequestW
HttpOpenRequestW
InternetSetOptionW
InternetCrackUrlW
InternetOpenW
InternetCloseHandle
InternetConnectW
InternetReadFile
InternetWriteFile
InternetQueryOptionW

gdi32

CreateCompatibleBitmap
GetTextCharset
TextOutW
GetObjectW
StrokePath
ChoosePixelFormat
SetPixelFormat
CreateBitmap
EndPath
GetPixel
GetCharacterPlacementW
BeginPath
GetGlyphIndicesW
CombineRgn
CreateCompatibleDC
CreateRectRgn
CreateRoundRectRgn
DeleteDC
DeleteObject
FrameRgn
GetStockObject
SelectClipRgn
SelectObject
StretchDIBits
CreateDIBSection
GetDeviceCaps
CreateFontIndirectW
CreatePen
EnumFontFamiliesExW
GetCharABCWidthsW
GetFontData
GetGlyphOutlineW
GetOutlineTextMetricsW
GetTextAlign
GetTextExtentPoint32W
GetFontUnicodeRanges
SetBkColor
SetBkMode
SetTextColor
SetTextAlign
SwapBuffers

comdlg32

GetOpenFileNameW

shell32

SHGetFolderPathW
SHFileOperationW
SHCreateItemFromParsingName
SHCreateItemInKnownFolder
SHAppBarMessage
DragFinish
DragQueryPoint
DragQueryFileW
ShellExecuteW
ord680
ShellExecuteExW

ole32

CoCreateGuid
OleDuplicateData
DoDragDrop
ReleaseStgMedium
RevokeDragDrop
RegisterDragDrop
OleUninitialize
OleInitialize
CoInitializeEx
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance

oleaut32

VarUI4FromStr

bcrypt

BCryptGenRandom

giflib

DGifSlurp
DGifOpen
DGifCloseFile

Sections

.text
Size: 17.0MB - Virtual size: 17.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 702KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 604KB - Virtual size: 603KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 817KB - Virtual size: 817KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

22d3e47cf7227c26d8735c3ac03af75c

Code Sign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

11:45:b9:56:f1:b8:9c:26:d2:97:f7:7fCertificate

Extended Key Usages

Key Usages

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1dCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fcCertificate

Key Usages

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

41:f1:2f:02:33:32:9e:5f:21:f3:d5:c0:a8:50:0c:2a:a9:e5:19:e9:f2:98:69:26:e5:21:c4:25:3a:22:e1:65Signer

Signature Validations

Verification

19-05-2022 23:32 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

msvcp140

shlwapi

imm32

concrt140

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

glu32

opengl32

jpeg62

libpng16

tiff

comctl32

mscms

rpcrt4

winmm

boost_date_time

zlib

gdiplus

boost_thread

version

boost_regex

crypt32

ws2_32

wininet

gdi32

comdlg32

shell32

ole32

oleaut32

bcrypt

giflib

Sections

.text Size: 17.0MB - Virtual size: 17.0MB

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

11:45:b9:56:f1:b8:9c:26:d2:97:f7:7f
Certificate

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

41:f1:2f:02:33:32:9e:5f:21:f3:d5:c0:a8:50:0c:2a:a9:e5:19:e9:f2:98:69:26:e5:21:c4:25:3a:22:e1:65
Signer

19-05-2022 23:32
Valid: true

.text
Size: 17.0MB - Virtual size: 17.0MB

.rdata
Size: 3.5MB - Virtual size: 3.5MB

.data
Size: 702KB - Virtual size: 1.1MB

_RDATA
Size: 10KB - Virtual size: 10KB

.rsrc
Size: 604KB - Virtual size: 603KB

.reloc
Size: 817KB - Virtual size: 817KB